Security & audits

Security disclosure

Security & audits

June 2026 technical review, Aristotle / Lean proofs, and session records for integrators, auditors, and token holders.

Executive summary→ Scope & methodology

Vault curation

CreatorOVault risk report

Protocol-level funds, control, liquidity, and monitoring note for greenfield CreatorOVaults (qualitative — no numeric score).

Read the report→

Report structure

Recommended reading order for Report 4626-FABLE-2026-06:

Published review

Report	4626 Technical Security Review — June 2026
Repository	wenakita/4626
Review period	9–13 June 2026
Primary deliverable	Full technical report

8 Parallel workstreams

47 Lead review sessions

97 Published session records

3 + 6 Critical + high findings

June 2026 security review

Recommended first read Executive summary Critical and high-severity findings with severity definitions and primary evidence references. Scope Scope & methodology Systems in scope, validation approach, evidence grading, and release-readiness conclusion at review date. Full report Full technical report Architecture map, complete finding register (C/H/M/L), baseline validation, test gaps, and remediation guidance. Appendix A Source sessions Curated session register linking to supplementary engagement records.

Aristotle

Machine-checked Lean 4 proofs of lottery and fee math via Aristotle. Complements the June 2026 review; does not replace it.

Start here Introduction What Aristotle and Lean are, what a proof means, and how to read Proven vs queued claims. Proven 2.5× boost Personal lottery boost stays in 1.0×–2.5×; coverage blend only applies the covered uplift. Proven All targets (proven) Five Lean targets: win chance, VRF fairness, fee-split conservation, jackpot fraction.

Peer-protocol gap analysis

July 2026 ERC-4626 peer-protocol gap analysis Pattern study of audited Morpho, Euler, Sommelier, Beefy, and Yearn V3 vault codebases mapped against the OVault stack, with ranked adopt/adapt/reject recommendations.

Limitations & disclaimer

This publication documents a read-only technical security review of the 4626 monorepo (June 2026). It is not a formal smart-contract audit certificate from an independent security firm and is not legal or investment advice. Findings reflect repository state at review time; verify remediation against current code and public disclosures before launch or integration. Authoritative conclusions are in the executive summary and full report; appendices are supplementary session records. Aristotle pages prove stated formulas only.

Aristotle · 2.5× boost (proven) · Lean proof targets · Transcript archive · Session chronology · Machine-readable logs (JSONL) · Impairment disclosures